Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elliptic Curve Cryptography: A Basic Introduction

blog.boot.dev

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Elliptic Curve Cryptography: A Basic Introduction

#21

Post by tooltower »

cgshep wrote: post #12

It's important to note that most ECC is not quantum-resistant and will be obsoleted in the coming years following completion of NIST's post-quantum cryptography competition. Indeed, OpenSSH recently enabled PQC by default (NTRU Prime over X25519) [1]. ECC has, at best, a short-to-medium term lifespan right now. 1. https://www.zdnet.com/article/openssh-now-defaults-to-protec...

AFAIK post-quantum crypto all has larger key sizes and much(?) worse performance. Has that changed? If not, I don't see ECC becoming obsolete any time soon.

Re: Elliptic Curve Cryptography: A Basic Introduction

#22

Post by marcelluscat »

tooltower wrote: post #21
cgshep wrote: post #12

It's important to note that most ECC is not quantum-resistant and will be obsoleted in the coming years following completion of NIST's post-quantum cryptography competition. Indeed, OpenSSH recently enabled PQC by default (NTRU Prime over X25519) [1]. ECC has, at best, a short-to-medium term lifespan right now. 1. https://www.zdnet.com/article/openssh-now-defaults-to-protec...

AFAIK post-quantum crypto all has larger key sizes and much(?) worse performance. Has that changed? If not, I don't see ECC becoming obsolete any time soon.

I thought ring-lwe was pretty good. It's at least very embarrassingly parallel

Re: Elliptic Curve Cryptography: A Basic Introduction

#23

Post by eternityforest »

tooltower wrote: post #21
cgshep wrote: post #12

It's important to note that most ECC is not quantum-resistant and will be obsoleted in the coming years following completion of NIST's post-quantum cryptography competition. Indeed, OpenSSH recently enabled PQC by default (NTRU Prime over X25519) [1]. ECC has, at best, a short-to-medium term lifespan right now. 1. https://www.zdnet.com/article/openssh-now-defaults-to-protec...

AFAIK post-quantum crypto all has larger key sizes and much(?) worse performance. Has that changed? If not, I don't see ECC becoming obsolete any time soon.

We will probably just see more tricks like computing keys from random seeds and storing cached key exchanges, and AMP style clickbait accelerators to funnel stuff through CDNs you already have the key for(Assuming the EU lets us do that....)

Re: Elliptic Curve Cryptography: A Basic Introduction

#24

Post by eternityforest »

politelemon wrote: post #18
adgjlsfhk1 wrote: post #14

Earlier quoted context omitted.

also, elliptic curves are much more vulnerable to quantum attacks than regular rsa since it uses smaller keys.

I wouldn't say more vulnerable necessarily — it requires fewer qubits, but requires larger coherence time. RSA requires more qubits and drastically less time. They're both vulnerable in different ways.

Isn't coherence time the big challenge?

Re: Elliptic Curve Cryptography: A Basic Introduction

#25

Post by kebman »

quenix wrote: post #9

As some others have pointed out, this is very basic stuff, but a good introduction. I have found this series of blog posts [0] as a super useful explanation of ECC that starts with the basics but covers the math and underlying group theory well, building up to an intermediate-level understanding of the matter. [0] https://andrea.corbellini.name/2015/05/17/elliptic-curve-cry...

I remember making inputs into Desmos or some similar graphing package. Gave some pretty interesting and surprising results in that the whole thing broke apart into something more akin to noise. If I indeed did it correctly, then it makes a lot of sense.

Re: Elliptic Curve Cryptography: A Basic Introduction

#27

Post by magicalhippo »

mypastself wrote: post #3

This is indeed basic. Half the article explains public key cryptography, the other gives a basic overview that omits key details, such as the purpose of reflection, and how the curve can get combined with finite fields in practical applications (although point 2 does partly address this aspect). Not a bad way to get a general intuition of the algorithm, but not overly useful, either.

Reading the article, it reminded me of the "how to draw an owl" meme[1].

Not quite as bad but, I didn't really get any good insight in how ECC works.

[1]: https://knowyourmeme.com/memes/how-to-draw-an-owl

Re: Elliptic Curve Cryptography: A Basic Introduction

#28

Post by Robotbeat »

lamontcg wrote: post #26

Is ECC at all mathematically related to Kepler's equation? (although now that i look at it, I'm not confident that is a trapdoor function because while its much easier to code one way than the other, the sin function itself needs an iterative approximation).

Usually need lossless integer math for cryptography to work. So the form might be similar, but you’re working over finite fields (ie of integers mod some number), not real numbers.

(Okay, I have only a tenuous understanding of this myself. I’m a physicist, not a mathematician! Mathematicians are intimidating.)

Re: Elliptic Curve Cryptography: A Basic Introduction

#29

Post by dmlerner »

eternityforest wrote: post #24
politelemon wrote: post #18

Earlier quoted context omitted.

I wouldn't say more vulnerable necessarily — it requires fewer qubits, but requires larger coherence time. RSA requires more qubits and drastically less time. They're both vulnerable in different ways.

Isn't coherence time the big challenge?

I imagine it's a similar tradeoff - with more qubits there are more interactions, ergo lower coherence time

Re: Elliptic Curve Cryptography: A Basic Introduction

#30

Post by KMag »

cgshep wrote: post #12

It's important to note that most ECC is not quantum-resistant and will be obsoleted in the coming years following completion of NIST's post-quantum cryptography competition. Indeed, OpenSSH recently enabled PQC by default (NTRU Prime over X25519) [1]. ECC has, at best, a short-to-medium term lifespan right now. 1. https://www.zdnet.com/article/openssh-now-defaults-to-protec...

I have a mind to write a PQC daemon to negotiate/rotate WireGuard pre-shared keys. Even though WireGuard uses 3-way ECDH using Curve25519, with a 256-bit pre-shared key, an attacker will either need 2^128 work using Grover's quantum search algorithm or else find statistical flaws in ChaCha20.

That way, you keep the post-quantum crypto out of the kernel, and if done carefully by hashing together PQC, ECDH, and a pre-shared-pre-key to generate the pre-shared key, it would be easier to demonstrate that it's no weaker than WireGuard. If the daemon removes and forgets the negotiated pre-shared-keys after 24 hours, then against classic attackers you'd still have perfect forward secrecy, and against quantum attackers you'd have 24-hour forward secrecy (assuming no statistical flaws in ChaCha20).

Post reply on HN